‘Hackers steal cars with phone cameras’, Expert warns of growing global threat

A Nigerian United States-based expert in Automotive Cybersecurity, Engr. Sunday Aluko, has raised the alarm on a growing global threat – hackers stealing cars using just a phone camera. Aluko, leveraging his expertise in the automotive industry, emphasized the urgent need for car manufacturers and owners to adopt robust cybersecurity measures to combat this evolving […]

A Nigerian United States-based expert in Automotive Cybersecurity, Engr. Sunday Aluko, has raised the alarm on a growing global threat – hackers stealing cars using just a phone camera.

Aluko, leveraging his expertise in the automotive industry, emphasized the urgent need for car manufacturers and owners to adopt robust cybersecurity measures to combat this evolving crime.

With modern vehicles relying heavily on electronic systems, car thieves now exploit vulnerabilities that require no physical tampering.

By simply capturing the Vehicle Identification Number (VIN) displayed on a car’s windshield, they can duplicate keys with an automated VIN to key tools, bypass security systems, and steal vehicles within seconds

The Vehicle Identification Number (VIN) is a unique 17-character code stamped on every vehicle, providing essential information such as make, model, and manufacturing history. While the VIN is critical for legitimate purposes like recalls and repairs, it has become a tool for criminals in the digital age.

Briefing newsmen, Aluko explained how snapping a photo of the VIN allows hackers to automate key cutting, clone electronic key fobs, and exploit a vehicle’s electronic systems. This method requires no broken windows, no tampered wires, and no physical struggle.

The process of using a VIN to access and steal a vehicle is faster and more straightforward than many might think. Hackers exploit the Vehicle Identification Number (VIN), often visible on a car’s windshield. After obtaining a car’s VIN, they use automated VIN decoders and key programming devices to decode the key specifications associated with it. This allows them to create duplicate physical keys and program electronic fobs or chips to communicate with the vehicle’s immobilizer system. By doing so, they bypass the vehicle’s security measures and gain full access to the car’s electronic systems.

These tools were originally designed for registered locksmiths to assist customers who had lost all their keys. Unfortunately, these tools are now available to the public, making it easier for hackers to misuse them for car theft.

Legitimate locksmiths, use manufacturer databases or certified third-party systems to retrieve the key code linked to a VIN. This key code specifies the exact cuts and details required to create a duplicate key. For older vehicles without advanced electronic systems, this process might involve only physical key cutting. However, modern cars require additional steps, such as programming electronic components to ensure compatibility with the vehicle’s immobilizer.

To prevent misuse, reputable locksmiths always verify vehicle ownership before duplicating a key. They request documents such as proof of vehicle registration and the owner’s identity. If a locksmith skips this verification process, it’s a significant red flag indicating potential fraud or unethical behavior.

Even carelessly sharing your VIN or providing it to unverified professionals can make your vehicle a target for theft.

He noted that today’s car thieves operate discreetly, even in crowded spaces, leveraging technology to execute thefts swiftly.

“This is a global threat. All a hacker needs is your VIN to bypass security systems and drive away with your car in seconds,” Aluko said.

As vehicle technology advances globally, so do the tactics of cybercriminals.

In 2023, reports from cybersecurity agencies in Europe and North America revealed a sharp rise in VIN-based car thefts. Countries like Germany and Japan are already addressing these vulnerabilities through stricter regulations and enhanced cybersecurity protocols. However, the global automotive industry faces a significant challenge in staying ahead of these threats.

To mitigate the risk of VIN-based car theft, Aluko highlighted the importance of concealing the VIN displayed on dashboards, particularly in public spaces. He also recommended additional security measures such as steering wheel locks, storing wireless key fobs in protective pouches, and ensuring vehicle software is regularly updated to patch vulnerabilities.

He emphasized the need for automakers to enhance encryption protocols and implement robust cybersecurity frameworks in vehicle design.

He also called on policymakers to introduce regulations that mandate stronger security features in cars.

“All it takes is a photo of your license plate or VIN for a hacker to compromise your car’s security,” Aluko warned. “Automakers and owners must work together to safeguard vehicles. Awareness and proactive measures are key.”

As an advocate for a safer automotive future, Aluko urged stakeholders to prioritize cybersecurity. “The rise in VIN-based car theft highlights the urgency for global action. It’s not just about protecting assets; it’s about securing the future of transportation.”

He concluded by emphasizing the importance of vigilance among car owners. “While technology has made our lives easier, it has also introduced new risks. Protecting your vehicle begins with awareness and taking simple preventive steps.